Related Articles

18 Comments

  1. 1

    yatin

    sachin.. this is whats happening to me right now.. i cannot access microsoft.com, yahoo, linkedin from my desktop.. but i can using my laptop which is connected to the same mtnl router.. how do i fix this ? cannot bring up the router page from both.

    Like or Dislike: Thumb up 0 Thumb down 0

    1. 1.1

      R Sachin

      Hi yatin,

      The disclosure affects routers, hence whether you use a laptop or desktop you will face the same issue. In your case this is not so.

      Consider, scanning your desktop for Virus/Malware related issues and also request your support engineer to check for any hardware and other issues.

      More Information about downloading and our other products:
      http://escanav.com/english/

      Regards
      Sachin R.

      Like or Dislike: Thumb up 0 Thumb down 0

  2. Pingback: Disclosure : Router based DNS MITM Attack | Welcome to the eScan … | DNS Internet

  3. 2

    Jagjot

    I was having trouble with microsoft and bing… i kinda wondered where the attack was originating when a clean install didnt remove my apparent selective browser hijack. I was just about to use a 4.2.2.2 dns to check when i ran into this blog.

    This means another call to airtel for the username and password for the connection. wish i had saved it the first time around :(

    If i understand correctly this should only affect PPPoA configs right? with the pppoe config the dns config should be behind the windows or a 3rd party firewall…

    Like or Dislike: Thumb up 0 Thumb down 0

  4. 3

    Pradeep

    I am also facing the same issue. Even after doing a complete check from AVG and eliminating all viruses, trojans, am still unable to access the websites identified. Any solution for this?

    Many have posted the problem here. Its very recent and spreading!!

    http://www.ipillion.com/ip/212.113.36.83

    Like or Dislike: Thumb up 0 Thumb down 0

  5. 4

    Nikhil

    hi sachin ,
    i am having the same problem . i tried to open yahoo site with another router and it opened but it is not so with mine . first can you explain me in detail what has happened and hot to fix this one . (new to these things ….)

    Like or Dislike: Thumb up 0 Thumb down 0

  6. Pingback: Cannot connect to update.microsoft.com or microsoft download servers - Page 2

  7. 5

    R Sachin

    @Jagjot: Not necessary . Any CPE which has a login console and allows addition of a DNS server is at risk .

    @Pradeep:
    Resolution for this problem has been explained in the blogpost.

    Additionally – configure your router to allows Remote access to console only from a specific internal lan IP. comes under ACL in some routers.

    Alternatively, disable DHCP and use Static IP Adddress with Static DNS server IP of a known server eg. 8.8.8.8

    @Nikhil: use nslookup to verify for usage of command view the Screen-Shot in this blogpost.

    Regards
    Sachin.

    Like or Dislike: Thumb up 0 Thumb down 0

    1. 5.1

      Bryan

      Today is Monday and my uervse was set up this past Friday, I would not call myself a satisfied customer . Of course the technician that AT&T sent to do the install, knows how to hook up the wires and perform some very basic tests (he knew what ipconfig did but did not know how to use the switch /all)), he informed me that he had no training on the modem when I asked about port forwarding (I suspect he probably didn’t know what port forwarding was). The Motorola router is a big disappointment, I have been putzing around with it all weekend trying to get the port forwarding to work, it does not. I was going to try using my netgear dsl modem/router but suspected it would not work with the uervse, so I like the idea of setting up in passthrough mode tonight. The interface has been stripped down to the point to where it’s a one size fits all vanilla setup. They have restricted the functionality to where if you want to veer from their vanilla, you’re better off buying your own $30 router which has myriad more options, like Wireless Distribution System (WDS). I have had trouble with AT&T DNS in the past and had already been using static DNS entries. The majority of the time I could tracert faster to Google’s San Francisco routers faster than to AT&T in Atlanta, 150 miles away. I will try the passthrough tonight and we’ll see how it goes. One other issue I had with the modem that I haven’t seen mentioned here is the .ha redirect. During the setup phase, the first time you use your browser, it (the motorola router) redirects your home page (in my case google) to AT&T registration page. After the registration is successful, it does not go away and keeps taking you back to it. I could not go to google .com, annoying to say the least. I spent almost 2 hours fixing this in both Chrome and IE 9. My mother, who was playing angry birds on her iPhone at the time, had the redirect come up where the ads usually do inside angry birds. The AT&T tech support in Mombai have never heard of this redirect issue. Ya, right. Thanks for posting this site, good advice, cheers from the South. Rick

      Like or Dislike: Thumb up 0 Thumb down 0

  8. 6

    nikhil

    sachin a gr8 article and very helpful……
    keep it up bro.

    Like or Dislike: Thumb up 0 Thumb down 0

  9. 7

    JPS

    I think using OpenDNS servers can save the router. And I agree that DHCP should be disabled within Router.It enhances the security. better to use odd series for internal LAN like 192.168.253.1.

    Like or Dislike: Thumb up 0 Thumb down 0

    1. 7.1

      Mani

      Well Rick,As long as it works, I don’t care who my peroidvr is. I moved to AT T since Comcast here kept raising their prices (they have an effective monopoly in San Francisco with speeds above 15Mbps).I guess in a year, I’ll move back.Good luck with the move. Ron

      Like or Dislike: Thumb up 0 Thumb down 0

  10. 8

    Rahul

    Hi Sachin,
    I was also facing the same issue and your post is very useful. I do not understand much of technical jargon but after discussing with MTNL triband support, I have specifed dns server and ip addresses instead of using the “automatic” setting. After doing this the problem seems to be resolved. Also I have changed my router password. I did not understand the point about “telnet” and “DeSOPA the firefox extension”. Basically I need to know if my connection is secure enough to start using credit cards online and if not, what else should I do? Also will this problem reoccur? It would be great if you reply with some simple instructions for a lay person like myself. Also kudos to you for raising this issue !!

    Like or Dislike: Thumb up 0 Thumb down 0

    1. 8.1

      R Sachin

      @JPS : Thanks for mentioning OpenDNS – that is one great service. But Never use OpenDNS option provided within the modem. use it within your Operating system.
      @nikhil : Thanks.
      @Rahul:
      re: DeSOPA – https://addons.mozilla.org/en-US/firefox/addon/desopa/

      Every modem provides you with the feature to restrict access to its configuration i.e. Do you want to allow access to router’s config from Internet ? recommended answer = NO . so the only way is to provide access to the router’s config from a specific IP address on LAN .

      Ask your system engineer he will guide you through this -/ ie. which option is where etc etc.

      Will this problem re-occur ? :) cant say much on this.

      Regards
      Sachin

      Like or Dislike: Thumb up 0 Thumb down 0

  11. Pingback: Exceptional – Botnets and Exploit Kits | Welcome to the eScan Blog

  12. Pingback: DNSChange Botnet | Welcome to the eScan Blog

  13. 9

    internetworksolutions.net@cisco bootcamp

    I was also facing the same issue and your post is very useful. I do not understand much of technical jargon but after discussing with MTNL triband support, I have specifed dns server and ip addresses instead of using the “automatic” setting. After doing this the problem seems to be resolved.ccnp bootcamp

    Like or Dislike: Thumb up 0 Thumb down 0

  14. 10

    http://derangedfolks6540.soup.io

    Une fois de plus un excellent post, je pense en discuter dans la semaine
    avec mes voisins

    Like or Dislike: Thumb up 0 Thumb down 0

Comments are closed.

Copyright © 2017 MicroWorld Technologies Inc. - Anti-Virus escanav.com